Problem with CISCO WIRELESS CONTROLLER and RADIUS Authentication
Hello! We have a Cisco Wireless Controller 5508 with Aironet 1041 APs. To make the AP authenticate with RADIUS we need to set the following command manually in the AP: - radius-server vsa send Which as explained by cisco does the following: Command Purpose Router(config)# *radius-server vsa send* [*accounting* | *authentication*] Enables the network access server to recognize and use VSAs as defined by RADIUS IETF attribute 26. The thing is, the APs can only authenticate if this command is issued in the AP by cli and we need that the Wireless Controller can pass this configuration to the APs, which it doesn't support. So, anyone know why is it necessary and if there is another alternative or workaround to make it work without it? Nowadays we schedule a script to log in the AP and run the command. Thanks in advance.
Gustavo Vieira Oliveira wrote:
We have a Cisco Wireless Controller 5508 with Aironet 1041 APs.
To make the AP authenticate with RADIUS we need to set the following command manually in the AP:
This isn't a Cisco support list.
The thing is, the APs can only authenticate if this command is issued in the AP by cli
If FreeRADIUS sends an Access-Accept, and the user isn't allowed on the network... blame the AP. Read the vendor's AP documentation to see what it needs in an Access-Accept. And I highly doubt that this flag is required for RADIUS authentication to work. Many other people run the same hardware, and don't have these issues. Alan DeKok.
On 4 Jul 2013, at 13:12, Gustavo Vieira Oliveira <gustavov@sc.senai.br> wrote:
Hello!
We have a Cisco Wireless Controller 5508 with Aironet 1041 APs.
To make the AP authenticate with RADIUS we need to set the following command manually in the AP:
- radius-server vsa send
Which as explained by cisco does the following:
Command
Purpose
Router(config)# radius-server vsa send [accounting | authentication]
Enables the network access server to recognize and use VSAs as defined by RADIUS IETF attribute 26.
The thing is, the APs can only authenticate if this command is issued in the AP by cli and we need that the Wireless Controller can pass this configuration to the APs, which it doesn't support. So, anyone know why is it necessary and if there is another alternative or workaround to make it work without it?
Nowadays we schedule a script to log in the AP and run the command.
This is FreeRADIUS related how? Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
Hi, This isn't a FreeRADIUS issue, and shouldn't really be on this list. However - On Thu, Jul 04, 2013 at 09:12:40AM -0300, Gustavo Vieira Oliveira wrote:
We have a Cisco Wireless Controller 5508 with Aironet 1041 APs.
We have the same, authenticating against FreeRADIUS.
To make the AP authenticate with RADIUS we need to set the following command manually in the AP:
- radius-server vsa send
That is odd, and I would guess that you have something not set up correctly on the controller (I assume your APs are all lightweight and correctly joined to the controller). It all works fine here with no manual configuration of the APs at all - they get all their config from the controller, as they should do. The APs don't do any RADIUS themselves - it's all handled from the controller. So I can't understand why they would need to know anything about RADIUS attributes.
The thing is, the APs can only authenticate if this command is issued in the AP by cli and we need that the Wireless Controller can pass this configuration to the APs, which it doesn't support. So, anyone know why is it necessary and if there is another alternative or workaround to make it work without it?
I would check that your WLANs are correctly configured with the RADIUS servers in the controller. You shouldn't need to configure the APs like this. You're better off asking on another mailing list, though. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Yeah, i'm not saying it's a problem with RADIUS. I'm just asking trying to understand why it's happening and if there may be any workaround for this. Matthew, we have some remote places that we chose to authenticate locally with Radius. I'm guessing the configuration (radius-server vsa send) is need because of this or am i wrong: attr_rewrite getssid-bsn { attribute = Called-Station-Id searchin = packet searchfor = ".................:BSN" replacewith = "BSN" ignore_case = yes new_attribute = no } attr_rewrite getssid-COL { attribute = Called-Station-Id searchin = packet searchfor = ".................:COL" replacewith = "COL" ignore_case = yes new_attribute = no } attr_rewrite getssid-bsn-cisco { attribute = Cisco-AVPair searchin = packet searchfor = "....=BSN" replacewith = "BSN" ignore_case = yes new_attribute = no } attr_rewrite getssid-col-cisco { attribute = Cisco-AVPair searchin = packet searchfor = "....=COL" replacewith = "COL" ignore_case = yes new_attribute = no } We make this to identify the SSID which the user is trying to login to make up the LDAP filter. Can anyone explain if it's the reason why we need a VSA sent to the NAS and if we're doing something wrong? Is there any other suggestion? Sorry if i'm still asking something that may not be related to this forum. Em 04/07/2013 09:29, Matthew Newton escreveu:
Hi,
This isn't a FreeRADIUS issue, and shouldn't really be on this list.
However -
On Thu, Jul 04, 2013 at 09:12:40AM -0300, Gustavo Vieira Oliveira wrote:
We have a Cisco Wireless Controller 5508 with Aironet 1041 APs. We have the same, authenticating against FreeRADIUS.
To make the AP authenticate with RADIUS we need to set the following command manually in the AP:
- radius-server vsa send That is odd, and I would guess that you have something not set up correctly on the controller (I assume your APs are all lightweight and correctly joined to the controller).
It all works fine here with no manual configuration of the APs at all - they get all their config from the controller, as they should do. The APs don't do any RADIUS themselves - it's all handled from the controller. So I can't understand why they would need to know anything about RADIUS attributes.
The thing is, the APs can only authenticate if this command is issued in the AP by cli and we need that the Wireless Controller can pass this configuration to the APs, which it doesn't support. So, anyone know why is it necessary and if there is another alternative or workaround to make it work without it? I would check that your WLANs are correctly configured with the RADIUS servers in the controller. You shouldn't need to configure the APs like this.
You're better off asking on another mailing list, though.
Matthew
participants (4)
-
Alan DeKok -
Arran Cudbard-Bell -
Gustavo Vieira Oliveira -
Matthew Newton